mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
b0856dcf7b
Snipe-IT v8.8.1 refuses any `login_remote_user_header_name` matching `/^HTTP_/i`, so the configured `HTTP_X_FORWARDED_PREFERRED_USERNAME` stopped minting sessions behind oauth2-proxy. Apache in the image now copies `X-Forwarded-Preferred-Username` into the server variable `INFINITO_SSO_USER`, and only when the request also carries `X-Infinito-Sso-Proxy` equal to the new per-inventory `sso_proxy_secret`; an empty secret keeps the bridge closed. openresty sends that header on every proxied request, so a client reaching the container directly cannot log in by forging the identity header. A deploy-time check asserts both directions (forged 200, with secret 302). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
19 lines
799 B
YAML
19 lines
799 B
YAML
---
|
|
credentials:
|
|
app_key:
|
|
description: "Generic 32-byte base64 key with base64: prefix"
|
|
algorithm: base64_prefixed_32
|
|
validation: ^base64:[A-Za-z0-9+/]{43}=$
|
|
mcp_bearer:
|
|
description: "Bearer an MCP client must present to this role's adapter instance. Distinct from the upstream credential the adapter presents, because authenticating
|
|
to the application says nothing about who called the adapter."
|
|
algorithm: alphanumeric
|
|
validation: "^[A-Za-z0-9]{32,}$"
|
|
length: 48
|
|
sso_proxy_secret:
|
|
description: "Shared secret the reverse proxy sends with every request; Apache in the Snipe-IT container only turns the trusted identity header into the login
|
|
variable when it matches."
|
|
algorithm: alphanumeric
|
|
validation: "^[A-Za-z0-9]{32,}$"
|
|
length: 48
|